Subject: zero valid lifetime

From: Yukiyo Akisada <[email-masked]>
Date: Thu, 29 Sep 2005 10:16:27 +0900

Hi, all.

I was confusing about valid lifetime.

<draft-ietf-ipv6-rfc2462bis-08.txt> says
RA with the value 0 of valid lifetime is invalid, if RA isn't authenticated.

  5.5.3  Router Advertisement Processing
  ------------------------------------------------------------------------
  1044       2.  If RemainingLifetime is less than or equal to 2 hours, ignore
  1045           the Prefix Information option with regards to the valid
  1046           lifetime, unless the Router Advertisement from which this
  1047           option was obtained has been authenticated (e.g., via Secure
  1048           Neighbor Discovery [RFC3971]).  If the Router Advertisement
  1049           was authenticated, the valid lifetime of the corresponding
  1050           address should be set to the Valid Lifetime in the received
  1051           option.
  ------------------------------------------------------------------------

Furthermore chapter 8 also says it is invalid clearly.

  8.  Acknowledgements
  ------------------------------------------------------------------------
  1217    Erik Nordmark.  Thanks also goes to John Gilmore for alerting the WG
  1218    of the "0 Lifetime Prefix Advertisement" denial of service attack
  1219    vulnerability; this document incorporates changes that address this
  1220    vulnerability.
  ------------------------------------------------------------------------

But <draft-ietf-ipv6-2461bis-04.txt> says,
the value 0 is just a special case.

  6.3.4.  Processing Received Router Advertisements
  ------------------------------------------------------------------------
  2945       - If the prefix is already present in the host's Prefix List as

  2954         the result of a previously-received advertisement, reset its
  2955         invalidation timer to the Valid Lifetime value in the Prefix
  2956         Information option.  If the new Lifetime value is zero, time-out
  2957         the prefix immediately (see Section 6.3.5).
  ------------------------------------------------------------------------

Unauthenticated RA with valid Lifetime=0 is invalid packet, right?
I feel putting text to 6.3.4 makes 2461bis more clear.
How do you think?

Thanks,

------------------------------------------------------------------------
Yukiyo Akisada <[email-masked]>

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Thu, 29 Sep 2005 09:12:45 +0200

In your previous mail you wrote:

   
=> you should read the whole subsection 6.3.4 because it is clear the
"on-link" function and "addrconf" function follow a different rule about
valid lifetime (2461bis text is about "on-link" and has no DoS issue,
2462bis text is about "addrconf" and has the 2 hour rule).

Regards

[email-masked]

---

From: Yukiyo Akisada <[email-masked]>
Date: Fri, 30 Sep 2005 09:34:16 +0900

Francis,
Thank you very much.

Now I can be clear.
Subsequent text was very important.

   <draft-ietf-ipv6-2461bis-04.txt>
   6.3.4.  Processing Received Router Advertisements
   ------------------------------------------------------------------------
   2963    Stateless address autoconfiguration [ADDRCONF] may in some
   2964    circumstances use a larger Valid Lifetime of a prefix or ignore it
   2965    completely in order to prevent a particular denial of service attack.
   2966    However, since the effect of the same denial of service targeted at
   2967    the on-link prefix list is not catastrophic (hosts would send packets
   2968    to a default router and receive a redirect rather than sending
   2969    packets directly to a neighbor) the Neighbor Discovery protocol does
   2970    not impose such a check on the prefix lifetime values. Similarly,
   2971    [ADDRCONF] may impose certain restrictions on the prefix length for
   2972    address configuration purposes. Therefore, the prefix might be
   2973    rejected by [ADDRCONF] implementation in the host. However, the 
   2974    prefix length is still valid for on-link determination when combined 
   2975    with other flags in the prefix option.
   2976
   2977       Note: Implementations can choose to process the on-link aspects of
   2978       the prefixes separately from the address autoconfiguration aspects
   2979       of the prefixes by, e.g., passing a copy of each valid Router 
   2980       Advertisement message to both an "on-link" and an "addrconf" 
   2981       function.  Each function can then operate independently on the 
   2982       prefixes that have the appropriate flag set.

On Thu, 29 Sep 2005 09:12:45 +0200